[package]
name = "ntfs-core"
version = "0.9.0"
edition.workspace = true
rust-version.workspace = true
license.workspace = true
description = "Pure-Rust from-scratch NTFS filesystem reader — MFT, attributes, indexes, data runs, over any Read + Seek source"
repository.workspace = true
homepage.workspace = true
documentation = "https://docs.rs/ntfs-core"
readme.workspace = true
authors.workspace = true
keywords = ["forensics", "ntfs", "filesystem", "dfir", "mft"]
categories.workspace = true
# Integration tests live under /tests and read fixtures from the repo-root
# tests/data via include_bytes!("../../tests/data/..."), which is outside this
# package. They are repo-CI artifacts, not consumer-facing — excluding them
# keeps the published tarball self-contained (no out-of-package include paths).
exclude = ["/fuzz", "/.github", "/docs", "/tests"]

[dependencies]
thiserror = { workspace = true }
# LZNT1 decompression for compressed $DATA. A maintained, no_std, unsafe-free
# pure-Rust codec that is correct on real Windows streams (validated byte-for-byte
# against The Sleuth Kit) and ships an encoder too — preferred over re-rolling our
# own decode-only copy.
lznt1 = { workspace = true }
# NTFS on-disk structure knowledge (magic bytes, field offsets, type codes)
# lives in the KNOWLEDGE layer â the published forensicnomicon crate.
forensicnomicon = { workspace = true }
# USN journal record parsing: typed reason/attribute flag sets and FILETIME
# timestamp conversion for $UsnJrnl:$J records.
bitflags = { workspace = true }
chrono = { workspace = true }

[dev-dependencies]
# Independent oracle for doer-checker validation against real $MFT images
# (parity gate in tests/parity_mft.rs). MIT/Apache-2.0 â dev-only, no GPL.
mft = { workspace = true }

[lints]
workspace = true
